T08 · Insecure Dependencies
Note
- Location
scripts/generate_report.py:19- Finding
Unpinned Third-Party Dependency Installation Guidance
- Content
View full analysis
- Remediation
View remediation
Security audit
平安保险顾问助手
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent and not deceptive, but it handles sensitive health and financial insurance data without enough upfront privacy, storage, or external-sharing safeguards.
Install only for authorized insurance-advisor workflows where customers have consented to share health and financial details. Before using Feishu, PDF, email, or customer archives, require explicit destination confirmation, redact unnecessary sensitive data, store records only in approved systems, and use pinned dependencies for the report generator.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_report.py:118- Finding
Unescaped Input Is Interpreted as ReportLab Paragraph Markup
- Content
View full analysis
- Remediation
View remediation
text` - Link tags - Unbalanced tags - XML metacharacters such as `<`, `>`, `&`, quotes, and apostrophes - Oversized input values 7. Treat generated reports as untrusted until rendering succeeds and expected document content has been validated. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill is designed to collect extensive KYC, health, family, income, debt, and insurance data, including special-category health information, but it provides no upfront privacy notice or data-handling warning before collection begins. In this context, that omission materially increases the risk of uninformed disclosure, over-collection, and unsafe processing of regulated personal data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The Feishu document generation instructions direct the agent to write full customer insurance analysis into an external document system, but there is no required user-facing warning that sensitive health and financial data will leave the conversation and be stored externally. Because the report content includes detailed personal and medical information, silent export creates a substantial confidentiality and compliance risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match ordinary insurance conversations, which can cause the skill to activate outside clearly bounded user intent. In this skill, accidental activation is more dangerous because it leads into collection of highly sensitive financial and health data and may steer users into external document generation without an upfront scope check.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The SOP explicitly directs collection of highly sensitive personal, health, and financial data for insurance underwriting and advisory purposes, but it does not include any privacy notice, lawful-basis guidance, minimization principle, consent expectations, storage requirements, or retention constraints. In the context of an insurance-advisor skill, this omission materially increases the risk of over-collection, improper handling, unauthorized disclosure, and noncompliance with privacy obligations because agents are being operationally guided to gather special-category data without any handling safeguards.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document instructs staff to establish customer archives containing health disclosures, financial details, policy information, and communication records, yet provides no safeguards for secure storage, least-privilege access, encryption, retention periods, or disposal procedures. Because this skill is specifically designed for ongoing customer dossier management, the absence of these controls makes unauthorized access, insider misuse, accidental leakage, and excessive retention more likely.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The module docstring states in Chinese that the tool generates an insurance plan report, and the generated report content throughout the file is hard-coded in Chinese. This imposes a specific language/locale on users without any opt-in or explanation that the skill is intended only for a Chinese-language or region-specific workflow.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This code file contains user-facing natural-language descriptions entirely in Chinese, including the module description and recommendation reasons, with no indication that language selection is configurable or limited to a region-specific use case. The policy for this audit requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This file presents all instructions, templates, and operational guidance exclusively in Chinese, with no indication that users can select another language or that the locale restriction is required for a region-specific purpose. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation.
- Content